Splunk behind reverse proxy keeps redirecting me to 127.0.0.1

[Simon]

Hi all,

I've place splunkweb behind a reverse proxy and bound splunkweb and splunkd to 127.0.0.1.
The config:

splunk-launch.conf:

SPLUNK_BINDIP=127.0.0.1

web.conf:

[settings]
mgmtHostPort = 127.0.0.1:8189
httpport = 8100
tools.proxy.on = True
enableSplunkWebSSL = True

Apache's httpd.conf:

SSLProxyEngine On
ProxyPass /cgi-bin !
ProxyPass / https://127.0.0.1:8100/ retry=0
ProxyPassReverse / https://127.0.01:8100/ retry=0

When I now open splunk via the reverse proxy (https://mysplunksrv.domain.local), I get redirected to https://127.0.0.1:8100/de-DE/
Hitting directly https://mysplunksrv.domain.local/en-US/account/login opens the login page, after loggin in, I get redirected again to https://127.0.0.1:8100/de-DE/.

Any ideas?
Thx,
Simon

[gkanapathy · Accepted solution]

Seems you have a typo in your ProxyPassReverse directive? But you also should put

ProxyPreserveHost On

in your Apache config.

[Simon]

Oh god... how embarassing. The typo was the key. Thanks for pointing it out!

[gkanapathy]

Seems you have a typo in your ProxyPassReverse directive?

[jbouch03]

Have you tried using the actual IP of the Splunk system in the Splunk binding? I haven't tried this on my setup, but it looks like the redirect is caused by the Splunk binding. Try using the actual IP of the system and see if it fixes the issue.

[Simon]

I only want to access splunk via web proxy, which is bound to the actual ip. Splunk should not listen to any non-local interface. But it works now, it was a typo (see below)